The invoice looks genuine. Are the payment details?

A familiar name isn't always proof

Many businesses work with the same suppliers for years.

That familiarity makes everyday transactions easier. It can also create opportunities for criminals.

A fraudulent payment request might appear to come from a supplier you've dealt with regularly. It could refer to a genuine invoice, include familiar names or arrive within what appears to be an existing email conversation.

In some cases, criminals gain access to a legitimate email account. In others, they create convincing messages that imitate the sender.

The request itself may seem reasonable. Perhaps the supplier has changed banks, or an urgent payment needs to be made before the end of the day.

The important point is that a familiar name, convincing email or genuine-looking invoice doesn't automatically mean the payment instructions are correct.

Build a simple check into payments

One of the most useful protections is also one of the simplest.

If a supplier asks you to change their bank details, verify the request independently before making a payment.

That means contacting the supplier using a telephone number you already hold or have independently verified, rather than relying on the details supplied in the email.

The same principle applies to unexpected requests from senior colleagues.

If somebody asks for an unusual or urgent payment, it should be acceptable to check the instruction before acting.

For organisations processing regular payments, it is worth agreeing a consistent approach to verifying changes, recording approvals and ensuring the right people can authorise payments.

These checks should be proportionate to the business, but they shouldn't disappear simply because somebody says a payment is urgent.

Protect the accounts behind the process

Payment fraud isn't always caused by somebody believing a fake email.

Sometimes criminals gain access to genuine business accounts and use them to send convincing requests.

That makes protecting email and financial accounts particularly important.

The National Cyber Security Centre recommends securing business email with strong, unique authentication and using passkeys where supported, or strong passwords and two-step verification.

Organisations should also consider who has access to financial information, supplier records and payment systems.

Does everybody with access still need it? Are important accounts appropriately protected? Would somebody notice an unexpected change?

Good account security and sensible payment checks work together.

Neither should be treated as a substitute for the other.

Make it easy for people to challenge

A well-designed process is only useful if people feel comfortable following it.

Imagine a colleague receives an urgent payment request that appears to come from the business owner.

They may recognise something unusual but worry about delaying an important transaction or questioning somebody more senior.

That hesitation is understandable.

Managers can help by making it clear that checking unexpected requests is part of doing the job properly.

People should know they can pause a payment, contact a supplier independently or ask for a second opinion without being criticised for causing a delay.

A short conversation about what to check can be more useful than a lengthy warning about fraud.

The aim is to create an environment where verification is normal, rather than something people only do when they already suspect a scam.

Know what to do if something goes wrong

Even with sensible precautions, mistakes can happen.

If somebody believes a fraudulent payment has been made, acting quickly is important.

Contact your bank immediately using its official contact details and explain what has happened. Your bank may be able to take action to help recover the money or prevent further losses.

You should also alert whoever manages your organisation's IT or security arrangements, particularly if an email account may have been compromised.

Preserve relevant messages and payment records, and report the fraud through the appropriate official reporting service.

The NCSC provides guidance on responding to business payment fraud, including what to do if a business account has been compromised.

The important message for colleagues is straightforward: raise the concern immediately, even if you're unsure what has happened.